> You are reading the Docusign Developer Documentation. For clean Markdown of any page, append .md to the page URL.
>
> Documentation indexes by section:
> - APIs and SDKs: https://docusign.docs.buildwithfern.com/docs/llms.txt
> - Platform 101: https://docusign.docs.buildwithfern.com/platform/llms.txt
> - Extension Apps: https://docusign.docs.buildwithfern.com/extension-apps/llms.txt
> - Docusign CLI: https://docusign.docs.buildwithfern.com/docusign-cli/llms.txt
>
> Authentication (OAuth, JWT Grant, M2M): https://docusign.docs.buildwithfern.com/platform/auth
> Webhooks and Connect: https://docusign.docs.buildwithfern.com/platform/webhooks
>
> OpenAPI specifications: https://docusign.docs.buildwithfern.com/openapi.json
> MCP server: https://docusign.docs.buildwithfern.com/_mcp/server

# Implicit Grant Authentication

> Learn about the Implicit Grant OAuth flow and when you should implement it for your app.

*Implicit Grant* is an OAuth 2.0 flow that is used to grant an access token to integrations that are not able to store sensitive data on a secure server, such as those that are native to mobile devices.

In the Implicit Grant flow, your integration requests an access token directly. This is potentially less secure because the access token must be stored on the user’s device, but it does not require that the integration have access to a web server.

> **Warning**
>
> **Alert**: [Public Authorization Code Grant](/platform/auth/authcode#public-authorization-code-grant) should be used rather than Implicit Grant whenever possible. Neither Public Authorization Code Grant nor Implicit Grant require access to a web server to secure a client secret, but Public Authorization Code Grant provides greater security.